Adversarially robust machine learning has received much recent attention.
However, prior attacks and defenses for non-parametric classifiers have been
developed in an ad-hoc or classifier-specific basis. In this work, we take a
holistic look at adversarial examples for non-parametric classifiers, including
nearest neighbors, decision trees, and random forests. We provide a general
defense method, adversarial pruning, that works by preprocessing the dataset to
become well-separated. To test our defense, we provide a novel attack that
applies to a wide range of non-parametric classifiers. Theoretically, we derive
an optimally robust classifier, which is analogous to the Bayes Optimal. We
show that adversarial pruning can be viewed as a finite sample approximation to
this optimal classifier. We empirically show that our defense and attack are
either better than or competitive with prior work on non-parametric
classifiers. Overall, our results provide a strong and broadly-applicable
baseline for future work on robust non-parametrics. Code available at
this https URL .

文章系统研究了非参数分类器的对抗性问题，提出了全新的数据预处理方案 adverasrial pruning，并且得到了理论最优的鲁棒分类器，实验结果显示该方法更好或竞争性更好。

非参数分类的鲁棒性：一种通用攻击和防御

Robustness for Non-Parametric Classification: A Generic Attack and  Defense

We study the problem of learning classifiers with a fairness constraint, with
three main contributions towards the goal of quantifying the problem's inherent
tradeoffs. First, we relate two existing fairness measures to cost-sensitive
risks. Second, we show that for cost-sensitive classification and fairness
measures, the optimal classifier is an instance-dependent thresholding of the
class-probability function. Third, we show how the tradeoff between accuracy
and fairness is determined by the alignment between the class-probabilities for
the target and sensitive features. Underpinning our analysis is a general
framework that casts the problem of learning with a fairness requirement as one
of minimising the difference of two statistical risks.

本文研究学习分类器的公平性约束问题并提出了三种解决方案，分别是将两个现有的公平性度量关联到成本敏感风险，显示了对于成本敏感分类和公平性度量的最优分类器是类概率函数的实例相关阈值，并展示了准确性和公平性之间的权衡是通过目标和敏感特征的类概率之间的一致性来确定的。支撑我们分析的是一个通用框架，将具有公平要求的学习问题建模为两种统计风险差异的最小化问题。